Under HIPAA, policies that are in place to comply with HIPAA, must be kept for a minimum of six years after their creation, be available and updated as needed.
Upheal therefore stores the following documents:
The BAA you enter into with Upheal when signing up to the platform - maintained by Upheal for six years
Documentation of changes to HIPAA policies
We fulfill the availability requirement of the rule by sharing information on this Compliance page.
Upheal also reviews policies periodically, and makes updates as needed, in order to ensure continued security of the ePHI.